14652 matches found
WordPress Concours <= 1.1 - Authenticated Cross-Site Scripting (XSS)
The wp-concours WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
BackupGuard < 1.1.47 - Authenticated Cross-Site Scripting (XSS)
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
rk-responsive-contact-form 1.0 - Authenticated Blind SQL Injection
The rk-responsive-contact-form WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
Democracy Poll < 5.4 - CSRF & XSS
The Democracy Poll WordPress plugin was affected by a CSRF & XSS security vulnerability...
Time Sheets < 1.5.2 - Multiple XSS
The Time Sheets WordPress plugin was affected by a Multiple XSS security vulnerability...
Corner Ad < 1.0.8 - XSS
The Corner Ad WordPress plugin was affected by a XSS security vulnerability...
Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?author=1...
Podlove Podcast Publisher <= 2.3.15 - Multiple SQLi & XSS
The Podlove Podcast Publisher WordPress plugin was affected by a Multiple SQLi & XSS security vulnerability...
Nelio AB Testing <= 4.5.8 - Server Side Request Forgery (SSRF)
The Nelio AB Testing WordPress plugin was affected by a Server Side Request Forgery SSRF security vulnerability...
PeepSo <= 1.6.0 - Authenticated Privilege Escalation
Unfiltered input allows a logged in user to escalate their permissions to that of an Administrator...
WordPress 4.2-4.5.2 - Authenticated Attachment Name Stored XSS
...
WordPress 4.5.2 - oEmbed Denial of Service (DoS)
...
Jetpack <= 4.0.3 - Multiple Vulnerabilities
Jetpack 4.0.4 fixes 3 security bugs: Private feedback form entries were made available publicly via the REST API Post By Email settings could be changed The Likes module was vulnerable to XSS...
OptinMonster <= 1.1.4.5 - Execution of Arbitrary Shortcodes
Unauthenticated users are able to execute arbitrary WordPress shortcodes via a simple HTTP GET request. While the command is protected by a nonce, the nonce is leaked on every page load...
CP Reservation Calendar <= 1.1.6 - Unauthenticated SQL Injection
The CP Reservation Calendar WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
Captain Slider 1.0.6 - Cross-Site Scripting (XSS)
The captain-slider WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Googmonify <= 0.5.1 - CSRF & XSS
The Googmonify WordPress plugin was affected by a CSRF & XSS security vulnerability...
WP Ultimate Csv Importer < 3.8.1 - XSS
The Import and Export WordPress Data as CSV or XML WordPress plugin was affected by a XSS security vulnerability...
Broken Link Manager <= 0.5.5 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Broken Link Manager WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability...
NewStatPress <= 1.0.4 - SQL Injection
The Search functionality is susceptible to a SQL Injection attack due to usage of user input without sanitation. In particular, at line 98 of 'includes/nspsearch.php'. Utilising a specially crafted SQL query, we can trigger disclosure of user hashes through an IMG tag as the data channel. PoC The...
Powerplay Gallery - Arbitrary File Upload & SQL Injection
The wp-powerplaygallery WordPress plugin was affected by an Arbitrary File Upload & SQL Injection security vulnerability...
RobotCPA Plugin V5 - Unauthenticated Local File Inclusion
The robotcpa WordPress plugin was affected by an Unauthenticated Local File Inclusion security vulnerability. PoC This issue has been seen exploited in the wild with the following payload: http://www.example.com/wp-content/plugins/robotcpa/f.php?l=..%2F..%2F..%2Fwp-config.php...
ZoomSounds <= 2.0 - Remote File Upload
The dzs-zoomsounds WordPress plugin was affected by a Remote File Upload security vulnerability...
Digital Store < 1.3.3 - Unspecified XSS
The digital-store WordPress theme was affected by an Unspecified XSS security vulnerability...
Simple Ads Manager <= 2.5.94 - Arbitrary File Upload & SQL Injection
The simple-ads-manager WordPress plugin was affected by an Arbitrary File Upload & SQL Injection security vulnerability...
EasyCart 1.1.30 - 3.0.20 - Privilege Escalation
Due to a lack of validation in the ecajaxupdateoption and ecajaxclearalltaxrates functions located in /inc/admin/adminajaxfunctions.php, it is possible to update any WordPress option as an authenticated non-admin user, which can in turn lead to privilege escalation and remote code execution...
Google Doc Embedder <= 2.5.18 - Cross-Site Scripting (XSS)
The Google Doc Embedder WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Ad Manager <= 1.1.2 - Open Redirection
The wordpress-admanager WordPress plugin was affected by an Open Redirection security vulnerability...
Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)
The Contact Form Integrated With Google Maps WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
XCloner - Backup and Restore < 3.1.2 - Multiple Vulnerabilities (RCE & LFI)
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin was affected by a Backup and Restore 3.1.2 - Multiple Vulnerabilities RCE & LFI security vulnerability...
BookX 1.7 - includes/bookx_export.php file Parameter Remote Path Traversal File Access
The bookx WordPress plugin was affected by an includes/bookxexport.php file Parameter Remote Path Traversal File Access security vulnerability...
GTranslate 1.0.12 - gtranslate.php Widget Code Editing CSRF
The Translate WordPress with GTranslate WordPress plugin was affected by a gtranslate.php Widget Code Editing CSRF security vulnerability...
ShareThis 7.0.3 - Setting Manipulation CSRF
The share-this WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
Cart66 Lite 1.5.1.14 - admin.php cart66-products Page Product Manipulation CSRF
The cart66-lite WordPress plugin was affected by an admin.php cart66-products Page Product Manipulation CSRF security vulnerability...
SexyBookmarks - Setting Manipulation CSRF
The sexybookmarks WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
php-analytics - ofc_upload_image.php Arbitrary File Upload
The php-analytics WordPress plugin was affected by an ofcuploadimage.php Arbitrary File Upload security vulnerability...
seo-spy-google - ofc_upload_image.php Arbitrary File Upload
The seo-spy-google-wordpress-plugin WordPress plugin was affected by an ofcuploadimage.php Arbitrary File Upload security vulnerability...
geshi-source-colorer <= 0.13 - XSS in ZeroClipboard
The geshi-source-colorer WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Terillion Reviews < 1.2 - Profile Id Field XSS
The terillion-reviews WordPress plugin was affected by a Profile Id Field XSS security vulnerability...
click-to-copy-grab-box <= 0.1.1 - XSS in ZeroClipboard
The click-to-copy-grab-box WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Marekkis Watermark 0.9.2 - wp-admin/options-general.php pfad Parameter XSS
The Marekkis Watermark-Plugin WordPress plugin was affected by a wp-admin/options-general.php pfad Parameter XSS security vulnerability...
WP Super Cache 1.3 - trunk/plugins/domain-mapping.php URI XSS
The WP Super Cache WordPress plugin was affected by a trunk/plugins/domain-mapping.php URI XSS security vulnerability...
bbPress - forum.php page Parameter SQL Injection
The bbPress WordPress plugin was affected by a forum.php page Parameter SQL Injection security vulnerability...
Login Rebuilder < 1.2.0 - Cross Site Request Forgery
The Login rebuilder WordPress plugin was affected by a Cross Site Request Forgery security vulnerability...
Count Per Day <= 3.2.3 - notes.php note Parameter XSS
The Count per Day WordPress plugin was affected by a notes.php note Parameter XSS security vulnerability...
Contextual Related Posts < 1.8.7 - Cross-Site Request Forgery
The Contextual Related Posts WordPress plugin was affected by a Cross-Site Request Forgery security vulnerability, which could lead to Cross-Site Scripting issues...
WordPress <= 3.3.2 - Cross-Site Scripting (XSS) in wp-includes/default-filters.php
...
WordPress 3.6 - HTML File Upload Cross-Site Scripting (XSS)
...